Question 1

Does Onefend store the messages my employees write in ChatGPT?

Accepted Answer

No. Onefend does not store the full content of conversations. The system analyzes text to detect risk patterns and, if configured, retains only redacted evidence (with sensitive data hidden) when an incident is detected. Plain text messages are not saved.

Question 2

Do employees lose privacy after installing the extension?

Accepted Answer

The Onefend extension acts only on AI platforms the administrator configures. It does not access other websites, emails, or general browser activity. Users are only monitored in the context of AI tools authorized for review.

Question 3

Who can see the logged events?

Accepted Answer

Events are accessible based on the assigned role: users only see their own records, analysts can see activity for the entire organization, and administrators have full access. No access level exposes sensitive content in plain text.

Question 4

How long are records kept?

Accepted Answer

Data retention is configurable by the administrator according to organizational needs. By default, activity events are kept for 30 days and administrative audit logs for 90 days. The administrator can adjust these periods from the settings panel.

Question 5

Is Onefend difficult to implement?

Accepted Answer

No. Implementation is based on a browser extension that your employees install in Chrome or Edge with a unique access token. No changes to your network infrastructure, servers, or DNS are required. For mass deployments, centralized management tools (MDM/GPO) can be used to distribute the extension automatically.

Question 6

Which browsers are supported?

Accepted Answer

Currently, the Onefend extension is compatible with Google Chrome and Microsoft Edge (Chromium-based). Support for other browsers is in development.

Question 7

Which AI platforms does Onefend monitor?

Accepted Answer

Onefend monitors the leading AI platforms available in the market, including ChatGPT, Claude, Gemini, and Perplexity, among others. The catalog of recognized applications is updated periodically. Additionally, when an employee accesses an unknown tool, the system automatically detects it and adds it for administrator review.

Question 8

How long does it take to become operational?

Accepted Answer

Once the administrator generates the access token, installing the extension on each device takes a few minutes. The initial panel configuration — policies, user groups, and applications — can be completed on the same day for most cases.

Question 9

Can I block AI tools for certain teams and allow them for others?

Accepted Answer

Yes. Onefend allows you to define granular policies by user, by group, or for the entire organization. For example, you can block access to ChatGPT for the legal department and allow it with warnings for the marketing team, all from the same panel.

Question 10

What happens if an employee tries to send sensitive information to an AI?

Accepted Answer

It depends on the policy configured by the administrator. The system can block the message and notify the user with an explanation, show a warning so the employee can make an informed decision, or simply log the event for later review without disrupting the workflow.

Question 11

Does the system detect only text, or also images and files?

Accepted Answer

Onefend analyzes text content in real time. Analysis of attached images and documents is available as an additional capability. Consult with the Onefend team about the configuration available for your plan.

Question 12

What if an employee uses an AI tool from their phone?

Accepted Answer

Onefend's protection works through the extension installed in the device's browser. Mobile devices without the extension installed are not covered. For environments where mobile use is relevant, additional access control measures may be needed.

Question 13

Does Onefend help with regulatory compliance?

Accepted Answer

Onefend provides the tools that allow your organization to maintain control and traceability over AI use: audit records, event exports, access management, and configurable policies. Your organization's legal team determines how to apply them according to the specific regulations that apply.

Question 14

Can I export records for external audits?

Accepted Answer

Yes. The Onefend panel allows exporting events and audit logs in CSV and JSON format, with filters by period, user, event type, and risk level. These records can be provided to internal or external auditors as needed.

Question 15

Are audit logs immutable?

Accepted Answer

Yes. Administrative audit records (who changed what configuration and when) are immutable: no administrator can edit or delete them manually. This ensures their integrity as evidence.

Shadow AI FAQ: Security, Privacy & Compliance

Privacy and data

Implementation and compatibility

Security and control

Compliance and audit

Have more questions?

Related Articles

Start securing your AI journey - it's free and open source